a6db5bb40641cd889418a856ea9592dc0a4bcba52b546040989fc9e8390e63dc

Analysis

max time kernel
123s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 975KB
Sample260629-de79nacy2r
SHA256 a6db5bb40641cd889418a856ea9592dc0a4bcba52b546040989fc9e8390e63dc
MD5 c9b7dd14483b646ac6dcf3ab27bb8d8b
SHA1 68d5fea09f1d1cd7ffc8ada2e35fa5b1305fbf0c
SHA512 b832024f7ae916ac67dcb98a338d4e2104513575109d14e271777920d355269ac92dbb7269a1c9de9b6f9107006b8092c7a88a205e89b6d8383cd6dbe5b0dc1b
SSDEEP 24576:N454GXjQuvFXmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2ErU5Eqlzy8:qH0uvFXmDta4mT
TLSH
T1EC25A013A7A4D4F6D5330330C8E6A6E5F375BDB287208A4F27586E152E737D06E26722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4260	2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
5644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c9b7dd14483b646ac6dcf3ab27bb8d8b_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 975KB
SHA256 a6db5bb40641cd889418a856ea9592dc0a4bcba52b546040989fc9e8390e63dc
MD5 c9b7dd14483b646ac6dcf3ab27bb8d8b
SHA1 68d5fea09f1d1cd7ffc8ada2e35fa5b1305fbf0c
SHA512 b832024f7ae916ac67dcb98a338d4e2104513575109d14e271777920d355269ac92dbb7269a1c9de9b6f9107006b8092c7a88a205e89b6d8383cd6dbe5b0dc1b
SSDEEP 24576:N454GXjQuvFXmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2ErU5Eqlzy8:qH0uvFXmDta4mT
TLSH
T1EC25A013A7A4D4F6D5330330C8E6A6E5F375BDB287208A4F27586E152E737D06E26722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe
Size 1.1MB
SHA256 2c6e472f5981201ccbf2fc73afec16585be4ac6fde6784f1739e61e6f9f86b0e
MD5 2659eeb0b2f147490a3d442cf2e77a63
SHA1 e346fa829ad9463ddf3ed5872eda09ca3218d178
SHA512 d7fb0121af34a0eedfc8cf221976ee1e20dc8bf162ac1e1f8201385fce9201b8fb223b99928d1600fb8f7f8e4e2bac129613f0e34699154d093cf695c3858f8b
SSDEEP 24576:N454GXjQuvFXmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2ErU5EqlzycTjE:qH0uvFXmDta4mxw
TLSH
T12B359F13A7A4A0F6E5330330C8E1A6A5E776BDB247208B5F27585E152F737D06E36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe$

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$
Size 1.7MB
SHA256 4084c5288a200b0fb5e1bb92dde38bcee66ebe8f48c04c086a0ff194a15e1e0f
MD5 5efe3e7ed58e025a0f5b9037b70d1c27
SHA1 f18e126d717ace97b7432d1d1fd4d9a5dda2048b
SHA512 0dbe56dd6bfcec0e3a71f2eda4381dd274b26c264ef151f0a0f26f52cb4ce873762ec9ac1ad3f9b8fd2950fae5d480b77353602218a202fccda1062c6943ed55
SSDEEP 49152:qH0uvFXmDta4mnPMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMT:FaCWPMMHMMMvMMZMMMlmMMMiMMMYJMMP
TLSH
T1A8859D03F794D4B5E4730230897396A59776FD628B20865F32987B1E2E723C16E36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 c40de75c8d1d8b06206a00a6490d14979c6168603e2ba7fb529bb27fc3256f73
MD5 22ed3ade916c3be70d1213c285ae2b69
SHA1 0eec423a3b47f81bf7f6195c8c58705e606e29c4
SHA512 b47c45c1d79f74f8f5e3f33e969fe72358e85d36209211696f1cd678da5430037818282c8ceb31fa822907d6733bebb09580b5f3980f8d15873e190e8e295436
SSDEEP 24576:N454GXjQuvFXmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2ErU5EqlzyE0Le5jiS:qH0uvFXmDta4mPPji0Aj
TLSH
T1B7757D16F7A482B5D073C274C8D2A699EB71789247308ACF13949B682F737D19E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4260-1-0x0000000000600000-0x0000000000603000-memory.dmp

Download

memory/4260-24-0x0000000000600000-0x0000000000603000-memory.dmp

Download

memory/5644-9-0x0000000000660000-0x0000000000663000-memory.dmp

Download

memory/5644-25-0x0000000000660000-0x0000000000663000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads